Anthropic details distillation campaigns from Alibaba, Moonshot AI, and DeepSeek

In a significant report published this Thursday, Anthropic has unveiled evidence of persistent "distillation attacks" originating from China-based AI developers. As the global race for artificial intelligence supremacy intensifies, these unauthorized efforts to harvest the intellectual property and reasoning capabilities of U.S. frontier models have grown increasingly aggressive and sophisticated.

Sophisticated Tactics to Harvest Intelligence

Distillation attacks are designed to extract the "chain of thought"—the internal logical processing—from a model’s response. By capturing these reasoning traces, malicious actors can perform supervised fine-tuning to imbue smaller, proprietary models with the advanced capabilities of larger, more powerful systems.

While Anthropic typically hides its internal reasoning from end-users, opting instead to display simplified "summarized thinking" blocks, attackers have discovered clever workarounds. In one notable instance, a prompt was disguised as a translation task, instructing the model to output its working memory in "natural, accurate katakana-only Japanese."

“Over the last several months, unauthorized labs have developed increasingly sophisticated methods to circumvent our defenses and harvest the capabilities of US frontier models,” the report stated. “The campaigns we identified targeted some of Claude’s most valuable capabilities, including agentic capabilities and tool use, coding and data analysis, and logical reasoning.”

Major Campaigns Identified

Anthropic’s investigation identified nearly 200 million exchanges linked to five distinct distillation campaigns. The scale of these operations suggests a coordinated effort to bridge the performance gap between Chinese models and their American counterparts.

Key Findings:

• Alibaba’s Massive Effort: Representing the largest campaign ever observed by the company, this effort involved 151 million exchanges between May and July 2026. Utilizing 3,500 accounts with a fixed extraction prompt, the campaign appears aimed at training the Qwen model family.
• Moonshot AI and Military Ties: Anthropic reported that a campaign linked to the creators of Kimi seemingly routed requests from the Chinese military. One specific query involved analyzing closed-circuit surveillance footage to detect "abnormal behavior."
• Scale of Operations: The Moonshot AI campaign utilized a network of 5,000 accounts to fire nearly 300,000 requests at the Claude Opus model over a 10-day window.

A Growing Industry Concern

This is not the first time Anthropic has raised the alarm regarding model distillation. The company previously highlighted similar threats in February, and OpenAI has similarly reported activity attributed to DeepSeek. However, the latest data indicates that these campaigns are evolving in both volume and tactical complexity.

As frontier models become the backbone of modern digital infrastructure, the battle to protect the "thinking process" of these systems has become a central front in the broader geopolitical competition for AI dominance. Anthropic remains committed to identifying and neutralizing these unauthorized harvesting attempts as they continue to refine their defensive measures.